Cloud hosted Macs have a lot of benefits, such as being available 24/7 from anywhere in the world, being always online and having a blazing fast internet connection. That makes them great for remote iOS or macOS development environments, as well as for automated CI/CD pipelines, macOS servers and more. But, with great power comes great responsibility.
We often get asked about what best practices to apply when having a cloud hosted Mac, as it differs in some aspects from having a Mac located at your office.
The most important security measure you can take right now to ensure your Mac in the cloud is secure, is to use a strong and secure password. At OakHost, we provision the Macs for you with a strong, random password. However, due to the fact that this password will be shared with you via our Customer Panel, it is always recommended to change the password to something only you know. You can do this by following the official guide outlined by Apple.
Ensuring secure passwords holds also true for each service you are running on your Mac. For example, if you are running a web service, make sure to use a strong password for the user accounts, as well as for any database you might be using.
In a home or office network, local devices are usually protected by a restrictive firewall that only allows incoming connections from the local network. With cloud hosted Macs, a public IP address will be provided in order to simplify remote connections or for running publicly accessible services. Luckily, we provide a firewall service that can easily be enabled using our customer panel with just one click. This service is included with all Mac hosting plans and comes at no additional cost.
If you are just using your Mac for remote development, you should be able to apply the default configuration without any issues. This will prevent all external access to development services like a Redis server, a MySQL database or similar services, that are intended to only be accessed locally. Only access via SSH and Screen Sharing will be permitted by default, allowing you to continue working on your Mac in the cloud.
Should you be running a service that needs to be reachable from the internet, you can easily add a rule to the firewall to allow incoming connections to a specific port.
Apple regularly releases security updates for macOS, which are important to keep your Mac secure. By default, macOS will automatically check for updates and notify you when an update is available. It is highly recommended to install these updates as soon as possible, as they often contain important security fixes.
In addition to macOS updates, you should also keep your applications up to date. This is especially important for applications that are accessible from the internet, such as web servers, databases or similar services. These applications often contain security vulnerabilities that can be exploited by attackers to gain access to your Mac and should therefore always be kept up to date.
Securing your data is an important part of keeping your Mac secure. In case of a hardware failure, you want to make sure that your data is safe and can be restored. While Macs are incredibly reliable and hardware failures are rare, they can still happen. Due to their high level of hardware security, accessing the internal storage of a Mac that experienced a hardware failure can be difficult or even impossible. Therefore, it is important to have a backup of your data.
Luckily, macOS comes with a built-in backup solution called Time Machine. Time Machine allows you to automatically create periodic backups of your data and restore them in case of a hardware failure. To assist you with this, we offer optional Network Storage that can be used to store your Time Machine backups independent of your Mac. This ensures that your backups are safe even in case of a hardware failure.
When connecting to your Mac in the cloud, you should always use secure protocols. Luckily most protocols these days are secure and encrypted by design. This includes connecting via Screen Sharing, SSH, our Web-KVM or using most third party remote access tools like Jump Desktop or TeamViewer.
However, some versions of VNC are not secure by default and should therefore be avoided. If you are using a third party VNC client, make sure to verify whether the connection is encrypted or not. If you are using the built-in Screen Sharing app provided by macOS, you can rest assured that the connection is secure.
If for some reason you need or want to connect using an unencrypted protocol, like plain VNC, you can achieve this by using an SSH or VPN tunnel. We have tutorials on how to set this up here for SSH tunnels and here for WireGuard VPN tunnels.
While the above steps provide a good foundation for ensuring the security of your Mac in the cloud, security is always a complex topic and there are many more advanced measures you can take to further secure your Mac. If you want to read on, here are some additional steps you can take:
Whether you require a cloud-based Mac development environment or a robust cluster of CI/CD Mac servers, our team is prepared to provide unparalleled support and solutions.